NoKnowledge
The README has a major red flag:
> From the math perspective, there is no difference between private and public keys, they both can be used to encrypt messages that only can de be decrypted by the other. Most of the security tools, including enc, artificially forbid using the public key for decrypting messages because that's not how it should be used (encrypting messages that anyone can decrypt is pointless).
Most security tools forbid that because it is dangerous! Also, this description sounds like textbook RSA is being used...
But you mentioned the assumptions on the implementation, not on the underlying mathematics. The thing that concerns me is that QKD introduces additional hardware to operate, and there have been many demonstrations of weaknesses in that hardware that threaten the overall security of the system. With DIQKD you ensure that those issues no longer affect security (again it is absolutely remarkable that this is possible at all), but now you still have to concern yourself with all the implementation vulnerabilities that also plague classical cryptography. In that sense I mean that the implementation assumptions are now the same.
Otherwise the standard Person-in-the-Middle attack would apply: Eve (claiming to be Bob) first runs a full protocol session (quantum + classical communication) with Alice, resulting in a shared key X. Then she does the same to Bob, resulting in a key Y. When Alice wants to encrypt a message to Bob, she encrypts with X. Eve can decrypt (and optionally re-encrypt with Y and forward the message to Bob).
Would it be accurate to say it is scaled back to the level achieved by classical (non-quantum) cryptography?
Also I think the added value of device-independence is overstated. While it does indeed prevent loss of security by faulty quantum hardware (even if constructed maliciously), there is still a lot of classical post-processing required. That device still needs to be trusted. For example, when the device is outputting the shared key, it still needs to be trusted that it isn't also delivering that key back to Eve.
The blog post says the paper mentions 8.4e10 operations for factoring, but I can't find that number in the paper anywhere. The post then states: "The 800-bit claims would be 36 bits of work." I don't know what that means.
[edit]: the numbers are in the new version (https://eprint.iacr.org/2021/232). I was looking at the old version uploaded yesterday.
In that case the answer is: never. We've tried to generously interpret earlier factoring annealing results (there is nothing new in the top-posted paper) and had to conclude that the overall method just doesn't scale well: https://arxiv.org/abs/1902.01448
Skimming over the paper it seems their method of translating factorization to the optimization problem consists of simplifying equations without justification that this can be done efficiently. I suspect that their preprocessing step is already NP-hard.
The second and more important issue, is that the overall strategy---of translating a problem with a sub-exponential classical complexity (via the Number Field Sieve) to an optimization problem with exponential runtime---is not expected to succeed, as confirmed by careful measurements in our paper.
However, switching to the next generation of crypto only after the current generation is broken is not a solution. Much data needs to be kept secret for a long time. Internet traffic is currently being stored so that when the current crypto is broken all data can be decrypted retroactively.
Do you think we will see a Quantum Winter (or even several), similar to how we've had several AI Winters?
We see tremendous amounts of funding in academia (and also industry) to build ambitious projects that still have significant issues to overcome (both theoretical and engineering) before being any close to being implemented. At the same time there (still) seems to be much misunderstanding, such as Vivek Wadhwa's recent post[0] or various reports about an unhackable internet based on quantum information. I am afraid that this may lead to people having unrealistic expectations on what can be built and how fast it can be built, with the consequence that we will see less and less funding and investments in the nearby future.